You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: Path Manipulation/README.md
+11-4Lines changed: 11 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,14 +3,16 @@
3
3
## Definition as per OWASP
4
4
**Path Manipulation** attack also known as **Path Traversal** attack, aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files. It should be noted that access to files is limited by system operational access control (such as in the case of locked or in-use files on the Microsoft Windows operating system).
5
5
6
-
This attack is also known as _“dot-dot-slash”_, _“directory traversal”_, _“directory climbing”_ and _“backtracking”_.
6
+
This attack is also known as **"dot-dot-slash"**, **"directory traversal"**, **"directory climbing"** and **"backtracking"**.
7
+
8
+
You can use this repo as reference to fix the Path Manipulation issue [CWE-22](https://cwe.mitre.org/data/definitions/22.html), [CWE-34](https://cwe.mitre.org/data/definitions/34.html), [CWE-35](https://cwe.mitre.org/data/definitions/35.html), [CWE-73](https://cwe.mitre.org/data/definitions/73.html)
7
9
8
10
## Mitigation
9
11
10
12
Path Manipulation can be mitigated by validating the filename, folder name and extension validation and use the values further in the code only after the validations.
11
13
12
14
## NOTE
13
-
The code for the Path Manipulation only check for the Filename validation, Extension Validation, File Size Validation, Unique Filename Validation. ___It doesn't check for the File Contents and Magic Numbers. Use this logic when you are concerned about the Path Manipulation issue ONLY___.
15
+
The code for the Path Manipulation only check for the Filename validation, Extension Validation, File Size Validation, Unique Filename Validation. ***It doesn't check for the File Contents and Magic Numbers. Use this logic when you are concerned about the Path Manipulation issue ONLY***.
14
16
15
17
The Path Manipulation logic checks for the following:
16
18
- The Filename Validation, to only contain Alphanumeric values with the help of regex.
Copy file name to clipboardExpand all lines: Path Manipulation/while File Read/python/README.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,20 +11,20 @@ This python project is to help to mitigate the path manipulation issues. You can
11
11
12
12
You can try to play around this by following the Installation steps, check the Usage to run the Flask app.
13
13
14
-
## Installation
15
-
16
14
Please note that this project will try to fetch the files from your ___TEMP/Uploads___ directory. You can either manually create your files in the directory, or you can navigate to [Path Manipulation while File Upload Python Project](../../Path%20Manipulation%20while%20File%20Upload/python/) and follow the installation steps and Upload the test files.
Copy file name to clipboardExpand all lines: Path Manipulation/while File Upload/python/README.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,14 +9,14 @@ This python project is to help to mitigate the path manipulation issues. You can
9
9
10
10
[template](./securecodingexamples/fileupload/pathmanipulation/src/templates/) directory contains the index.html as frontend for the file upload with file type check on the client side.
11
11
12
-
You can try to play around this by following the Installation steps, check the Usage to run the Flask app.
12
+
You can try to play around by following the [Installation](#) steps, check the Usage to run the Flask app.
0 commit comments